Gateway Plugin Runtime

request → auth → policy → wasm hooks → channel relay → wasm stream/response hooks → audit

Gateway Plugin Runtime

架构

1request → auth → policy → wasm hooks → channel relay → wasm stream/response hooks → audit

internal/wasmhost/ 负责：

manifest 发现与加载（loader.go）
内置插件（builtin.go，wasm.binary: builtin:*）
wazero 外部 wasm 占位（runtime.go + WazeroPlugin）
fsnotify 热加载（manager.go）

ABI 子集

Hook	说明
`OnRequestHeaders`	请求头阶段
`OnRequestBody`	请求体（含 WAF）
`OnResponseBody`	非流式响应改写
`OnStreamChunk`	SSE chunk 改写

返回 ActionContinue / ActionStop；Stop 时网关直接回写 StopBody。

Manifest

yaml

1runtime: wasm
2enabled: true
3priority: 100
4scope:
5  tenant_ids: ["*"]
6  routes: ["/v1/*"]
7wasm:
8  binary: builtin:keyword-rewrite
9  host_capabilities: [audit_log, metrics_inc]
10config:
11  replacements:
12    secret-keyword: "[REDACTED]"

运维 API（internal）

GET /internal/plugins
POST /internal/plugins/reload
POST /internal/plugins/upload
GET /internal/errors — 24h 错误指纹聚类
POST /internal/channels/{id}/probe — Channel 自检
GET /internal/perf — Pyroscope 配置

Made-with: Damon Li